The disclosed subject matter relates to a method of detecting abnormality occurring during communication performed in an information processing system using a computer network.
In recent years, in a facility called a data center, in general, a plurality of server groups have normally been operated to continuously provide various services to users. In the data center, a plurality of network apparatuses are placed to perform communication between the server groups or communication between communication apparatuses such as personal computers or high-performance mobile phones of users and the server groups via the Internet. When a communication failure occurs due to hardware breakdown or software trouble in any one of the network apparatuses, services may not be provided to a plurality of users. Therefore, there is a concern that a data center operator may suffer a great loss of money depending on cases. For this reason, network administrators of the data center have to minimize the effects of failure by installing a network monitoring system that normally monitors the plurality of network apparatuses, and detects and treats the occurrence of a failure as quickly as possible.
JP-A-2005-285040 (hereinafter, referred to as Document 1) discloses a technology for collecting monitoring information based on obtained information with reference to a monitoring rule DB in which information regarding signs of a failure is registered in advance, when a network monitoring system detects the signs of a failure (Abstract). Accordingly, since information simultaneously being monitored can be reduced, a monitoring interval can be shortened.
JP-A-2010-186310 (hereinafter, referred to as Document 2) discloses a technology for registering a distribution of collapse of a correlation model in advance at the time of abnormality in an operational management apparatus and considering as the sign of a failure when an operational management apparatus determines that the distribution of the collapse of a correlation model at the time of abnormality tends to approximate a distribution of collapse when the system operates (Paragraph 0013). Accordingly, even when the number of collapsed failure models is small, abnormality can be detected.